Every vulnerability class, explained like an attacker and defended like an engineer.

Untrusted input is reflected into a page without correct output encoding, letting an attacker run JavaScript in a victim’s browser session.

User input is concatenated into a SQL query, letting an attacker alter query logic to read, modify, or destroy data.

The server fetches an attacker-controlled URL, enabling internal network access, cloud metadata theft, and request forgery.

A malicious site causes a victim’s browser to send authenticated state-changing requests they did not intend.

An endpoint exposes object identifiers but fails to verify that the caller is authorized for that specific object.

An XML parser configured to resolve external entities lets attackers read files, perform SSRF, or cause denial of service.

An attacker runs arbitrary code on the server - the most severe class, often via injection, deserialization, or vulnerable dependencies.

User input reaches a system shell, letting an attacker run OS commands on the host.

Attacker-controlled keys like __proto__ modify Object.prototype, corrupting application behavior and sometimes enabling RCE or XSS.

An attacker frames your site invisibly and tricks users into clicking sensitive controls.

A redirect parameter accepts arbitrary destinations, aiding phishing and token theft.

Manipulated file paths escape the intended directory to read or write arbitrary files.

Weak upload validation lets attackers store executable or malicious files on the server.

Flaws in proving identity - bypasses, weak credentials, broken resets, and missing rate limits.

The app authenticates users but fails to enforce what they are allowed to do.

Misused JSON Web Tokens - alg confusion, none, weak secrets, and missing validation - break authentication.

Misconfigured OAuth flows leak tokens or allow account takeover via redirect, state, and code handling flaws.

Over-permissive CORS lets malicious origins read authenticated responses from your API.

A missing or bypassable Content-Security-Policy removes a key layer of XSS and injection defense.

Valid requests used in unintended ways to gain advantage - the bugs scanners miss and humans love.

Concurrent requests exploit the gap between a check and its use to bypass limits.